BIND DNS server does not return an answer for dig +trace but it does when DNSSEC validation is disabled.

Issue

• BIND DNS server does not return an answer for dig +trace command.

  # rndc validation check
  DNSSEC validation is enabled (view _default)
  
  # dig @<DNS server> +trace example.com
  
  ; <<>> DiG 9.16.23-RH <<>> @<DNS server> +trace example.com
  ; (1 server found)
  ;; global options: +cmd
  ;; Received xx bytes from <DNS server>#53(<DNS server>) in yyy ms
  
  ===> no answers returned
  

• But the same command returned answer when DNSSEC validation is disabled in bind.

  # rndc validation off
  # rndc validation check
  DNSSEC validation is disabled (view _default)
  
  # dig @<DNS server> +trace example.com
  
  ; <<>> DiG 9.16.23-RH <<>> @<DNS server> +trace example.com
  ; (1 server found)
  ;; global options: +cmd
  .                       86400   IN      NS      k.root-servers.net.
  .                       86400   IN      NS      d.root-servers.net.
  .                       86400   IN      NS      c.root-servers.net.
  
  ...
  
  example.com.                  300     IN      A       xxx.xxx.xxx.xxx
  example.com.                  300     IN      A       xxx.xxx.xxx.yyy